OSAC-874: Remove EDA provider and webhook client from osac-operator

.claude/rules/configuration.md

@@ -2,33 +2,29 @@
 
 Config via environment variables from a Secret (see `config/samples/osac-config-secret.yaml`).
 
-## AAP Provider
+## AAP Provisioning
+
 - `OSAC_AAP_URL` — AAP server URL (required)
 - `OSAC_AAP_TOKEN` — authentication token (required)
 - `OSAC_AAP_TEMPLATE_PREFIX` — template name prefix (default: `osac`)
 - `OSAC_AAP_STATUS_POLL_INTERVAL` — job polling interval (default: 30s)
 - `OSAC_AAP_INSECURE_SKIP_VERIFY` — skip TLS verification (default: false)
 
-## EDA Provider
-- `OSAC_CLUSTER_CREATE_WEBHOOK` / `OSAC_CLUSTER_DELETE_WEBHOOK`
-- `OSAC_COMPUTE_INSTANCE_PROVISION_WEBHOOK` / `OSAC_COMPUTE_INSTANCE_DEPROVISION_WEBHOOK`
-
 ## Fulfillment Service gRPC
+
 - `OSAC_FULFILLMENT_SERVER_ADDRESS` — gRPC server address
 - `OSAC_FULFILLMENT_TOKEN_FILE` — path to auth token file
 
 ## Namespaces
+
 - `OSAC_CLUSTER_ORDER_NAMESPACE`, `OSAC_COMPUTE_INSTANCE_NAMESPACE`
 - `OSAC_TENANT_NAMESPACE`, `OSAC_NETWORKING_NAMESPACE`
 
 ## Controller Enable Flags
+
 - `OSAC_ENABLE_CLUSTER_CONTROLLER` / `--enable-cluster-controller`
 - `OSAC_ENABLE_COMPUTE_INSTANCE_CONTROLLER` / `--enable-compute-instance-controller`
 - `OSAC_ENABLE_TENANT_CONTROLLER` / `--enable-tenant-controller`
 - `OSAC_ENABLE_NETWORKING_CONTROLLER` / `--enable-networking-controller`
 
 If none set, all controllers run. If any set, only flagged controllers run.
-
-## Provisioning Provider
-- `OSAC_PROVISIONING_PROVIDER` — `aap` (default) or `eda`
-- Networking controllers always use AAP regardless of this setting

.claude/rules/controller-patterns.md

@@ -6,7 +6,7 @@ Each resource has two controllers:
 
 ```text
 Resource Controller                    Feedback Controller
-- Provisions via AAP/EDA               - Syncs CR state → fulfillment-service
+- Provisions via AAP                   - Syncs CR state → fulfillment-service
 - Manages finalizers and deletion       - Converts K8s Phase → proto State
 - Updates Phase, Conditions, etc.       - Sends Signal RPC on deletion
 ```

AGENTS.md

@@ -54,15 +54,11 @@ make undeploy
 
 ### Dual-Controller Pattern
 
-Each resource has a **resource controller** (provisions via AAP/EDA, manages finalizers) and a **feedback controller** (syncs state to fulfillment-service via gRPC). See `.claude/rules/controller-patterns.md` for reconciliation, finalizer, and AAP integration patterns.
+Each resource has a **resource controller** (provisions via AAP, manages finalizers) and a **feedback controller** (syncs state to fulfillment-service via gRPC). See `.claude/rules/controller-patterns.md` for reconciliation, finalizer, and AAP integration patterns.
 
-### Provisioning Providers
+### Provisioning
 
-Two backends via `ProvisioningProvider` interface (`pkg/provisioning/provider.go`):
-- **AAP** (`pkg/aap/client.go`) — direct AAP REST API integration
-- **EDA** (`pkg/provisioning/eda_provider.go`) — webhook-based triggers
-
-Selected via `OSAC_PROVISIONING_PROVIDER` env var (default: `aap`).
+All controllers use direct AAP REST API integration via the `ProvisioningProvider` interface (`pkg/provisioning/provider.go` and `pkg/aap/client.go`).
 
 ### Multi-cluster
 
@@ -119,7 +115,7 @@ Hooks are configured in `.claude/settings.json` and run automatically during age
 - **`controller-patterns.md`** — Dual-controller, reconciliation, finalizer, AAP, feedback, CRD type patterns
 - **`common-pitfalls.md`** — 10 common issues: regen, status loops, finalizers, AAP polling, NotFound, etc.
 - **`common-tasks.md`** — Adding CRDs/fields, cross-repo change order, RBAC, debugging
-- **`configuration.md`** — Environment variables for AAP, EDA, gRPC, namespaces, controller flags
+- **`configuration.md`** — Environment variables for AAP, gRPC, namespaces, controller flags
 
 ## PR Checklist
 

README.md

@@ -27,29 +27,15 @@ custom resources and reconciles them to their desired state:
 Configuration is supplied via environment variables (e.g. from a Secret mounted
 into the manager deployment). The following are supported:
 
-### Provisioning providers
+### AAP provisioning
 
-The operator supports two provisioning providers. The provider is selected
-**per-deployment** (not per-resource-type) and applies to all controllers that
-perform provisioning (ClusterOrder, ComputeInstance). Networking controllers
-(VirtualNetwork, Subnet, SecurityGroup) always use AAP.
+Controllers that perform infrastructure provisioning (ClusterOrder, ComputeInstance,
+and networking resources) integrate with Ansible Automation Platform over the REST
+API. The operator launches job/workflow templates and polls AAP for job status.
 
-- `OSAC_PROVISIONING_PROVIDER` — `"eda"` or `"aap"` (default: `"aap"`).
-  Ignored by networking controllers, which always use AAP.
-
-**EDA provider** — triggers external automation via webhooks. Job IDs are
-synthetic (`eda-webhook-N`). The EDA provider cannot poll for job status;
-completion is tracked via resource phase changes and finalizers.
-
-- `OSAC_CLUSTER_CREATE_WEBHOOK` — webhook URL for cluster provisioning.
-- `OSAC_CLUSTER_DELETE_WEBHOOK` — webhook URL for cluster deprovisioning.
-- `OSAC_COMPUTE_INSTANCE_PROVISION_WEBHOOK` — webhook URL for compute instance
-  provisioning.
-- `OSAC_COMPUTE_INSTANCE_DEPROVISION_WEBHOOK` — webhook URL for compute instance
-  deprovisioning.
-
-**AAP provider** — integrates directly with the Ansible Automation Platform REST
-API. Launches job/workflow templates and polls AAP for job status.
+Tenant storage provisioning is optional when AAP credentials or templates are not
+configured; the Tenant reconciler still manages namespace and UDN lifecycle. Feedback
+controllers sync state to the fulfillment service over gRPC only (no AAP integration).
 
 - `OSAC_AAP_URL` — AAP server URL (required).
 - `OSAC_AAP_TOKEN` — AAP authentication token (required).
@@ -101,8 +87,6 @@ Networking controllers derive template names from the prefix:
 - `OSAC_FULFILLMENT_SERVER_ADDRESS` — fulfillment service gRPC address
   (e.g. `fulfillment-service:50051`).
 - `OSAC_FULFILLMENT_TOKEN_FILE` — path to file containing the gRPC auth token.
-- `OSAC_MINIMUM_REQUEST_INTERVAL` — minimum duration between calls to the same
-  webhook URL (optional). Duration string, default: `0`.
 
 ### Controller enable flags
 

api/v1alpha1/job_types.go

@@ -64,9 +64,7 @@ func (s JobState) IsSuccessful() bool {
 
 // JobStatus represents the status of a provisioning or deprovisioning job
 type JobStatus struct {
-	// JobID is the job identifier from the provisioning provider
-	// For AAP Direct: job ID from AAP API response
-	// For EDA: auto-incremented "eda-webhook-N"
+	// JobID is the AAP job identifier from the provisioning provider API response.
 	// +kubebuilder:validation:Required
 	// +kubebuilder:validation:Type=string
 	JobID string `json:"jobID"`
@@ -90,9 +88,8 @@ type JobStatus struct {
 	// +kubebuilder:validation:Type=string
 	Message string `json:"message,omitempty"`
 
-	// BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails
-	// AAP Direct sets this to true to prevent orphaned cloud resources
-	// EDA sets this to false as webhook handles cleanup
+	// BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails.
+	// AAP sets this to true to prevent orphaned cloud resources when deprovisioning fails.
 	// +kubebuilder:validation:Optional
 	BlockDeletionOnFailure bool `json:"blockDeletionOnFailure,omitempty"`
 

charts/operator-crds/templates/osac.openshift.io_clusterorders.yaml

@@ -219,9 +219,8 @@ spec:
                   properties:
                     blockDeletionOnFailure:
                       description: |-
-                        BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails
-                        AAP Direct sets this to true to prevent orphaned cloud resources
-                        EDA sets this to false as webhook handles cleanup
+                        BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails.
+                        AAP sets this to true to prevent orphaned cloud resources when deprovisioning fails.
                       type: boolean
                     configVersion:
                       description: |-
@@ -231,10 +230,8 @@ spec:
                         If they match, the controller retries with exponential backoff.
                       type: string
                     jobID:
-                      description: |-
-                        JobID is the job identifier from the provisioning provider
-                        For AAP Direct: job ID from AAP API response
-                        For EDA: auto-incremented "eda-webhook-N"
+                      description: JobID is the AAP job identifier from the provisioning
+                        provider API response.
                       type: string
                     message:
                       description: Message provides human-readable status or error

charts/operator-crds/templates/osac.openshift.io_computeinstances.yaml

@@ -343,9 +343,8 @@ spec:
                   properties:
                     blockDeletionOnFailure:
                       description: |-
-                        BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails
-                        AAP Direct sets this to true to prevent orphaned cloud resources
-                        EDA sets this to false as webhook handles cleanup
+                        BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails.
+                        AAP sets this to true to prevent orphaned cloud resources when deprovisioning fails.
                       type: boolean
                     configVersion:
                       description: |-
@@ -355,10 +354,8 @@ spec:
                         If they match, the controller retries with exponential backoff.
                       type: string
                     jobID:
-                      description: |-
-                        JobID is the job identifier from the provisioning provider
-                        For AAP Direct: job ID from AAP API response
-                        For EDA: auto-incremented "eda-webhook-N"
+                      description: JobID is the AAP job identifier from the provisioning
+                        provider API response.
                       type: string
                     message:
                       description: Message provides human-readable status or error

charts/operator-crds/templates/osac.openshift.io_publicipattachments.yaml

@@ -147,9 +147,8 @@ spec:
                   properties:
                     blockDeletionOnFailure:
                       description: |-
-                        BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails
-                        AAP Direct sets this to true to prevent orphaned cloud resources
-                        EDA sets this to false as webhook handles cleanup
+                        BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails.
+                        AAP sets this to true to prevent orphaned cloud resources when deprovisioning fails.
                       type: boolean
                     configVersion:
                       description: |-
@@ -159,10 +158,8 @@ spec:
                         If they match, the controller retries with exponential backoff.
                       type: string
                     jobID:
-                      description: |-
-                        JobID is the job identifier from the provisioning provider
-                        For AAP Direct: job ID from AAP API response
-                        For EDA: auto-incremented "eda-webhook-N"
+                      description: JobID is the AAP job identifier from the provisioning
+                        provider API response.
                       type: string
                     message:
                       description: Message provides human-readable status or error

charts/operator-crds/templates/osac.openshift.io_publicippools.yaml

@@ -168,9 +168,8 @@ spec:
                   properties:
                     blockDeletionOnFailure:
                       description: |-
-                        BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails
-                        AAP Direct sets this to true to prevent orphaned cloud resources
-                        EDA sets this to false as webhook handles cleanup
+                        BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails.
+                        AAP sets this to true to prevent orphaned cloud resources when deprovisioning fails.
                       type: boolean
                     configVersion:
                       description: |-
@@ -180,10 +179,8 @@ spec:
                         If they match, the controller retries with exponential backoff.
                       type: string
                     jobID:
-                      description: |-
-                        JobID is the job identifier from the provisioning provider
-                        For AAP Direct: job ID from AAP API response
-                        For EDA: auto-incremented "eda-webhook-N"
+                      description: JobID is the AAP job identifier from the provisioning
+                        provider API response.
                       type: string
                     message:
                       description: Message provides human-readable status or error

charts/operator-crds/templates/osac.openshift.io_publicips.yaml

@@ -152,9 +152,8 @@ spec:
                   properties:
                     blockDeletionOnFailure:
                       description: |-
-                        BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails
-                        AAP Direct sets this to true to prevent orphaned cloud resources
-                        EDA sets this to false as webhook handles cleanup
+                        BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails.
+                        AAP sets this to true to prevent orphaned cloud resources when deprovisioning fails.
                       type: boolean
                     configVersion:
                       description: |-
@@ -164,10 +163,8 @@ spec:
                         If they match, the controller retries with exponential backoff.
                       type: string
                     jobID:
-                      description: |-
-                        JobID is the job identifier from the provisioning provider
-                        For AAP Direct: job ID from AAP API response
-                        For EDA: auto-incremented "eda-webhook-N"
+                      description: JobID is the AAP job identifier from the provisioning
+                        provider API response.
                       type: string
                     message:
                       description: Message provides human-readable status or error

charts/operator-crds/templates/osac.openshift.io_securitygroups.yaml

@@ -225,9 +225,8 @@ spec:
                   properties:
                     blockDeletionOnFailure:
                       description: |-
-                        BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails
-                        AAP Direct sets this to true to prevent orphaned cloud resources
-                        EDA sets this to false as webhook handles cleanup
+                        BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails.
+                        AAP sets this to true to prevent orphaned cloud resources when deprovisioning fails.
                       type: boolean
                     configVersion:
                       description: |-
@@ -237,10 +236,8 @@ spec:
                         If they match, the controller retries with exponential backoff.
                       type: string
                     jobID:
-                      description: |-
-                        JobID is the job identifier from the provisioning provider
-                        For AAP Direct: job ID from AAP API response
-                        For EDA: auto-incremented "eda-webhook-N"
+                      description: JobID is the AAP job identifier from the provisioning
+                        provider API response.
                       type: string
                     message:
                       description: Message provides human-readable status or error

charts/operator-crds/templates/osac.openshift.io_subnets.yaml

@@ -145,9 +145,8 @@ spec:
                   properties:
                     blockDeletionOnFailure:
                       description: |-
-                        BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails
-                        AAP Direct sets this to true to prevent orphaned cloud resources
-                        EDA sets this to false as webhook handles cleanup
+                        BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails.
+                        AAP sets this to true to prevent orphaned cloud resources when deprovisioning fails.
                       type: boolean
                     configVersion:
                       description: |-
@@ -157,10 +156,8 @@ spec:
                         If they match, the controller retries with exponential backoff.
                       type: string
                     jobID:
-                      description: |-
-                        JobID is the job identifier from the provisioning provider
-                        For AAP Direct: job ID from AAP API response
-                        For EDA: auto-incremented "eda-webhook-N"
+                      description: JobID is the AAP job identifier from the provisioning
+                        provider API response.
                       type: string
                     message:
                       description: Message provides human-readable status or error

charts/operator-crds/templates/osac.openshift.io_tenants.yaml

@@ -124,9 +124,8 @@ spec:
                   properties:
                     blockDeletionOnFailure:
                       description: |-
-                        BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails
-                        AAP Direct sets this to true to prevent orphaned cloud resources
-                        EDA sets this to false as webhook handles cleanup
+                        BlockDeletionOnFailure indicates whether CR deletion should be blocked if this job fails.
+                        AAP sets this to true to prevent orphaned cloud resources when deprovisioning fails.
                       type: boolean
                     configVersion:
                       description: |-
@@ -136,10 +135,8 @@ spec:
                         If they match, the controller retries with exponential backoff.
                       type: string
                     jobID:
-                      description: |-
-                        JobID is the job identifier from the provisioning provider
-                        For AAP Direct: job ID from AAP API response
-                        For EDA: auto-incremented "eda-webhook-N"
+                      description: JobID is the AAP job identifier from the provisioning
+                        provider API response.
                       type: string
                     message:
                       description: Message provides human-readable status or error